@aion0/forge 0.5.26 → 0.5.27

package/.forge/worktrees/pipeline-4dd8dc2d/lib/claude-templates.ts

@@ -0,0 +1,227 @@
+/**
+ * CLAUDE.md template management.
+ *
+ * Templates are reusable markdown snippets that can be appended to project CLAUDE.md files.
+ * Stored in <dataDir>/claude-templates/*.md with frontmatter metadata.
+ * Injection is idempotent — marked with <!-- forge:template:<id> --> comments.
+ */
+
+import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, unlinkSync } from 'node:fs';
+import { join, basename } from 'node:path';
+import { getDataDir } from './dirs';
+import YAML from 'yaml';
+
+const TEMPLATES_DIR = join(getDataDir(), 'claude-templates');
+
+export interface ClaudeTemplate {
+  id: string;           // filename without .md
+  name: string;
+  description: string;
+  tags: string[];
+  builtin: boolean;
+  isDefault: boolean;   // auto-inject into new projects
+  content: string;      // markdown body (without frontmatter)
+}
+
+function ensureDir() {
+  if (!existsSync(TEMPLATES_DIR)) mkdirSync(TEMPLATES_DIR, { recursive: true });
+}
+
+// ─── Built-in templates ──────────────────────────────────────
+
+const BUILTINS: Record<string, { name: string; description: string; tags: string[]; content: string }> = {
+  'typescript-rules': {
+    name: 'TypeScript Rules',
+    description: 'TypeScript coding conventions and best practices',
+    tags: ['typescript', 'code-style'],
+    content: `## TypeScript Rules
+- Use \`const\` by default, \`let\` only when needed
+- Prefer explicit return types on exported functions
+- Use \`interface\` for object shapes, \`type\` for unions/intersections
+- Avoid \`any\` — use \`unknown\` + type guards
+- Prefer early returns over nested if/else`,
+  },
+  'git-workflow': {
+    name: 'Git Workflow',
+    description: 'Git commit and branch conventions',
+    tags: ['git', 'workflow'],
+    content: `## Git Workflow
+- Commit messages: imperative mood, concise (e.g. "add feature X", "fix bug in Y")
+- Branch naming: \`feature/<name>\`, \`fix/<name>\`, \`chore/<name>\`
+- Always create a new branch for changes, never commit directly to main
+- Run tests before committing`,
+  },
+  'obsidian-vault': {
+    name: 'Obsidian Vault',
+    description: 'Obsidian vault integration for note search and management',
+    tags: ['obsidian', 'docs'],
+    content: `## Obsidian Vault
+When I ask about my notes, use bash to search and read files from the vault directory.
+Example: find <vault_path> -name "*.md" | head -20`,
+  },
+  'security': {
+    name: 'Security Rules',
+    description: 'Security best practices for code generation',
+    tags: ['security'],
+    content: `## Security Rules
+- Never hardcode secrets, API keys, or passwords
+- Validate all user inputs at system boundaries
+- Use parameterized queries for database operations
+- Sanitize outputs to prevent XSS
+- Follow OWASP top 10 guidelines`,
+  },
+};
+
+/** Ensure built-in templates exist on disk */
+export function ensureBuiltins() {
+  ensureDir();
+  for (const [id, tmpl] of Object.entries(BUILTINS)) {
+    const file = join(TEMPLATES_DIR, `${id}.md`);
+    if (!existsSync(file)) {
+      const frontmatter = YAML.stringify({ name: tmpl.name, description: tmpl.description, tags: tmpl.tags, builtin: true });
+      writeFileSync(file, `---\n${frontmatter}---\n\n${tmpl.content}\n`, 'utf-8');
+    }
+  }
+}
+
+// ─── CRUD ────────────────────────────────────────────────────
+
+function parseTemplate(filePath: string): ClaudeTemplate | null {
+  try {
+    const raw = readFileSync(filePath, 'utf-8');
+    const id = basename(filePath, '.md');
+    // Parse frontmatter
+    const fmMatch = raw.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
+    if (!fmMatch) return { id, name: id, description: '', tags: [], builtin: false, isDefault: false, content: raw.trim() };
+    const meta = YAML.parse(fmMatch[1]) || {};
+    return {
+      id,
+      name: meta.name || id,
+      description: meta.description || '',
+      tags: meta.tags || [],
+      builtin: !!meta.builtin,
+      isDefault: !!meta.isDefault,
+      content: fmMatch[2].trim(),
+    };
+  } catch { return null; }
+}
+
+export function listTemplates(): ClaudeTemplate[] {
+  ensureDir();
+  ensureBuiltins();
+  const files = readdirSync(TEMPLATES_DIR).filter(f => f.endsWith('.md')).sort();
+  return files.map(f => parseTemplate(join(TEMPLATES_DIR, f))).filter(Boolean) as ClaudeTemplate[];
+}
+
+export function getTemplate(id: string): ClaudeTemplate | null {
+  const file = join(TEMPLATES_DIR, `${id}.md`);
+  if (!existsSync(file)) return null;
+  return parseTemplate(file);
+}
+
+export function saveTemplate(id: string, name: string, description: string, tags: string[], content: string, isDefault?: boolean): void {
+  ensureDir();
+  // Preserve builtin flag if editing an existing built-in template
+  const existing = getTemplate(id);
+  const builtin = existing?.builtin || false;
+  const frontmatter = YAML.stringify({ name, description, tags, builtin, isDefault: !!isDefault });
+  writeFileSync(join(TEMPLATES_DIR, `${id}.md`), `---\n${frontmatter}---\n\n${content}\n`, 'utf-8');
+}
+
+/** Toggle default flag on a template */
+export function setTemplateDefault(id: string, isDefault: boolean): boolean {
+  const tmpl = getTemplate(id);
+  if (!tmpl) return false;
+  const file = join(TEMPLATES_DIR, `${id}.md`);
+  const raw = readFileSync(file, 'utf-8');
+  const fmMatch = raw.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
+  if (!fmMatch) return false;
+  const meta = YAML.parse(fmMatch[1]) || {};
+  meta.isDefault = isDefault;
+  writeFileSync(file, `---\n${YAML.stringify(meta)}---\n${fmMatch[2]}`, 'utf-8');
+  return true;
+}
+
+/** Auto-inject all default templates into a project if not already present */
+export function applyDefaultTemplates(projectPath: string): string[] {
+  const claudeMdPath = join(projectPath, 'CLAUDE.md');
+  const templates = listTemplates();
+  const injected: string[] = [];
+  for (const tmpl of templates) {
+    if (tmpl.isDefault && !isInjected(claudeMdPath, tmpl.id)) {
+      if (injectTemplate(claudeMdPath, tmpl.id)) {
+        injected.push(tmpl.id);
+      }
+    }
+  }
+  return injected;
+}
+
+export function deleteTemplate(id: string): boolean {
+  const tmpl = getTemplate(id);
+  if (!tmpl || tmpl.builtin) return false; // can't delete builtins
+  const file = join(TEMPLATES_DIR, `${id}.md`);
+  try { unlinkSync(file); return true; } catch { return false; }
+}
+
+// ─── Injection ───────────────────────────────────────────────
+
+const MARKER_START = (id: string) => `<!-- forge:template:${id} -->`;
+const MARKER_END = (id: string) => `<!-- /forge:template:${id} -->`;
+
+/** Check if a template is already injected in a CLAUDE.md */
+export function isInjected(claudeMdPath: string, templateId: string): boolean {
+  if (!existsSync(claudeMdPath)) return false;
+  const content = readFileSync(claudeMdPath, 'utf-8');
+  return content.includes(MARKER_START(templateId));
+}
+
+/** Get list of template IDs injected in a CLAUDE.md */
+export function getInjectedTemplates(claudeMdPath: string): string[] {
+  if (!existsSync(claudeMdPath)) return [];
+  const content = readFileSync(claudeMdPath, 'utf-8');
+  const ids: string[] = [];
+  const regex = /<!-- forge:template:(\S+) -->/g;
+  let match;
+  while ((match = regex.exec(content)) !== null) {
+    ids.push(match[1]);
+  }
+  return ids;
+}
+
+/** Append a template to a CLAUDE.md file. Returns false if already injected. */
+export function injectTemplate(claudeMdPath: string, templateId: string): boolean {
+  const tmpl = getTemplate(templateId);
+  if (!tmpl) return false;
+  if (isInjected(claudeMdPath, templateId)) return false;
+
+  const block = `\n${MARKER_START(templateId)}\n${tmpl.content}\n${MARKER_END(templateId)}\n`;
+
+  if (existsSync(claudeMdPath)) {
+    const existing = readFileSync(claudeMdPath, 'utf-8');
+    writeFileSync(claudeMdPath, existing.trimEnd() + '\n' + block, 'utf-8');
+  } else {
+    // Create new CLAUDE.md
+    const dir = join(claudeMdPath, '..');
+    if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+    writeFileSync(claudeMdPath, block.trimStart(), 'utf-8');
+  }
+  return true;
+}
+
+/** Remove a template from a CLAUDE.md file */
+export function removeTemplate(claudeMdPath: string, templateId: string): boolean {
+  if (!existsSync(claudeMdPath)) return false;
+  const content = readFileSync(claudeMdPath, 'utf-8');
+  const start = MARKER_START(templateId);
+  const end = MARKER_END(templateId);
+  const startIdx = content.indexOf(start);
+  const endIdx = content.indexOf(end);
+  if (startIdx === -1 || endIdx === -1) return false;
+
+  const before = content.slice(0, startIdx).trimEnd();
+  const after = content.slice(endIdx + end.length).trimStart();
+  const newContent = before + (after ? '\n\n' + after : '') + '\n';
+  writeFileSync(claudeMdPath, newContent, 'utf-8');
+  return true;
+}

package/.forge/worktrees/pipeline-4dd8dc2d/lib/cloudflared.ts

@@ -0,0 +1,424 @@
+/**
+ * Cloudflare Tunnel (cloudflared) integration.
+ * Zero-config mode: no account needed, gives a temporary public URL.
+ */
+
+import { spawn, execSync, type ChildProcess } from 'node:child_process';
+import { existsSync, mkdirSync, chmodSync, createWriteStream, unlinkSync, writeFileSync, readFileSync } from 'node:fs';
+import { platform, arch } from 'node:os';
+import { join } from 'node:path';
+import https from 'node:https';
+import http from 'node:http';
+import { getConfigDir, getDataDir } from './dirs';
+
+const BIN_DIR = join(getConfigDir(), 'bin');
+const BIN_NAME = platform() === 'win32' ? 'cloudflared.exe' : 'cloudflared';
+const BIN_PATH = join(BIN_DIR, BIN_NAME);
+
+// ─── Download URL resolution ────────────────────────────────────
+
+function getDownloadUrl(): string {
+  const os = platform();
+  const cpu = arch();
+  const base = 'https://github.com/cloudflare/cloudflared/releases/latest/download';
+
+  if (os === 'darwin') {
+    return cpu === 'arm64'
+      ? `${base}/cloudflared-darwin-arm64.tgz`
+      : `${base}/cloudflared-darwin-amd64.tgz`;
+  }
+  if (os === 'linux') {
+    if (cpu === 'arm64') return `${base}/cloudflared-linux-arm64`;
+    if (cpu === 'arm') return `${base}/cloudflared-linux-arm`;
+    return `${base}/cloudflared-linux-amd64`;
+  }
+  if (os === 'win32') {
+    return `${base}/cloudflared-windows-amd64.exe`;
+  }
+  throw new Error(`Unsupported platform: ${os}/${cpu}`);
+}
+
+// ─── Download helper ────────────────────────────────────────────
+
+const DOWNLOAD_TIMEOUT_MS = 120_000; // 2 minutes total per redirect hop
+
+function followRedirects(url: string, dest: string, redirectsLeft = 10): Promise<void> {
+  return new Promise((resolve, reject) => {
+    const client = url.startsWith('https') ? https : http;
+    const req = client.get(url, { headers: { 'User-Agent': 'forge/1.0' } }, (res) => {
+      if (res.statusCode && res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+        res.resume(); // drain redirect response
+        if (redirectsLeft <= 0) {
+          reject(new Error('Too many redirects'));
+          return;
+        }
+        followRedirects(res.headers.location, dest, redirectsLeft - 1).then(resolve, reject);
+        return;
+      }
+      if (res.statusCode !== 200) {
+        res.resume();
+        reject(new Error(`Download failed: HTTP ${res.statusCode}`));
+        return;
+      }
+      const file = createWriteStream(dest);
+      res.pipe(file);
+      file.on('finish', () => file.close(() => resolve()));
+      file.on('error', (err) => { try { unlinkSync(dest); } catch {} reject(err); });
+      res.on('error', (err) => { try { unlinkSync(dest); } catch {} reject(err); });
+    });
+    req.setTimeout(DOWNLOAD_TIMEOUT_MS, () => {
+      req.destroy(new Error(`Download timed out after ${DOWNLOAD_TIMEOUT_MS / 1000}s`));
+    });
+    req.on('error', reject);
+  });
+}
+
+// Guard against concurrent downloads
+let downloadPromise: Promise<string> | null = null;
+
+export async function downloadCloudflared(): Promise<string> {
+  if (existsSync(BIN_PATH)) return BIN_PATH;
+  if (downloadPromise) return downloadPromise;
+
+  downloadPromise = (async () => {
+    mkdirSync(BIN_DIR, { recursive: true });
+    const url = getDownloadUrl();
+    const isTgz = url.endsWith('.tgz');
+    const tmpPath = isTgz ? `${BIN_PATH}.tgz` : `${BIN_PATH}.tmp`;
+
+    // Clean up any leftover partial files from a previous failed attempt
+    try { unlinkSync(tmpPath); } catch {}
+
+    console.log(`[cloudflared] Downloading from ${url}...`);
+    try {
+      await followRedirects(url, tmpPath);
+    } catch (e) {
+      try { unlinkSync(tmpPath); } catch {}
+      throw e;
+    }
+
+    if (isTgz) {
+      // Extract tgz (macOS)
+      try {
+        execSync(`tar -xzf "${tmpPath}" -C "${BIN_DIR}"`, { encoding: 'utf-8' });
+      } finally {
+        try { unlinkSync(tmpPath); } catch {}
+      }
+    } else {
+      // Rename .tmp to final name atomically
+      const { renameSync } = require('node:fs');
+      renameSync(tmpPath, BIN_PATH);
+    }
+
+    if (platform() !== 'win32') {
+      chmodSync(BIN_PATH, 0o755);
+    }
+
+    console.log(`[cloudflared] Installed to ${BIN_PATH}`);
+    return BIN_PATH;
+  })().finally(() => {
+    downloadPromise = null;
+  });
+
+  return downloadPromise;
+}
+
+export function isInstalled(): boolean {
+  return existsSync(BIN_PATH);
+}
+
+// ─── Tunnel process management ──────────────────────────────────
+// Use globalThis to persist state across hot-reloads
+
+interface TunnelState {
+  process: ChildProcess | null;
+  url: string | null;
+  status: 'stopped' | 'starting' | 'running' | 'error';
+  error: string | null;
+  log: string[];
+}
+
+const stateKey = Symbol.for('mw-tunnel-state');
+const gAny = globalThis as any;
+if (!gAny[stateKey]) {
+  gAny[stateKey] = { process: null, url: null, status: 'stopped', error: null, log: [] } as TunnelState;
+}
+const state: TunnelState = gAny[stateKey];
+
+const MAX_LOG_LINES = 100;
+const TUNNEL_STATE_FILE = join(getDataDir(), 'tunnel-state.json');
+
+function saveTunnelState() {
+  try {
+    writeFileSync(TUNNEL_STATE_FILE, JSON.stringify({
+      url: state.url, status: state.status, error: state.error, pid: state.process?.pid || null,
+    }));
+  } catch {}
+}
+
+function loadTunnelState(): { url: string | null; status: string; error: string | null; pid: number | null } {
+  try {
+    return JSON.parse(readFileSync(TUNNEL_STATE_FILE, 'utf-8'));
+  } catch {
+    return { url: null, status: 'stopped', error: null, pid: null };
+  }
+}
+
+function pushLog(line: string) {
+  state.log.push(line);
+  if (state.log.length > MAX_LOG_LINES) state.log.shift();
+}
+
+export async function startTunnel(localPort: number = parseInt(process.env.PORT || '8403')): Promise<{ url?: string; error?: string }> {
+  console.log(`[tunnel] Starting tunnel on port ${localPort}...`);
+  // Prevent concurrent starts: state.process is already spawned, or another call is
+  // mid-flight between the guard and spawn (the async download window).
+  if (state.process || state.status === 'starting') {
+    return state.url ? { url: state.url } : { error: 'Tunnel is starting...' };
+  }
+
+  // Check if another process already has a tunnel running
+  const saved = loadTunnelState();
+  if (saved.pid && saved.status === 'running' && saved.url) {
+    try { process.kill(saved.pid, 0); return { url: saved.url }; } catch {}
+  }
+
+  // Claim 'starting' before any async work so concurrent callers are blocked
+  // from this point onward (pgrep kill + download can take seconds).
+  state.status = 'starting';
+  state.url = null;
+  state.error = null;
+  state.log = [];
+
+  // Kill ALL existing cloudflared processes to prevent duplicates
+  try {
+    const { execSync } = require('node:child_process');
+    const pids = execSync("pgrep -f 'cloudflared tunnel'", { encoding: 'utf-8', timeout: 3000, stdio: ['pipe', 'pipe', 'pipe'] }).trim();
+    for (const pid of pids.split('\n').filter(Boolean)) {
+      try { process.kill(parseInt(pid), 'SIGTERM'); } catch {}
+    }
+  } catch {}
+
+  // Generate new session code for remote login 2FA
+  try {
+    const { rotateSessionCode } = require('./password');
+    rotateSessionCode();
+  } catch {}
+
+  let binPath: string;
+  try {
+    binPath = await downloadCloudflared();
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    state.status = 'error';
+    state.error = msg;
+    return { error: msg };
+  }
+
+  return new Promise((resolve) => {
+    let resolved = false;
+
+    state.process = spawn(binPath, ['tunnel', '--url', `http://localhost:${localPort}`], {
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: { ...process.env },
+    });
+
+    const handleOutput = (data: Buffer) => {
+      const text = data.toString();
+      for (const line of text.split('\n')) {
+        if (!line.trim()) continue;
+        pushLog(line);
+
+        const urlMatch = line.match(/(https:\/\/[a-z0-9-]+\.trycloudflare\.com)/);
+        if (urlMatch && !state.url) {
+          state.url = urlMatch[1];
+          state.status = 'running';
+          saveTunnelState();
+          console.log(`[cloudflared] Tunnel URL: ${state.url}`);
+          startHealthCheck();
+          if (!resolved) {
+            resolved = true;
+            resolve({ url: state.url });
+          }
+        }
+      }
+    };
+
+    state.process.stdout?.on('data', handleOutput);
+    state.process.stderr?.on('data', handleOutput);
+
+    state.process.on('error', (err) => {
+      state.status = 'error';
+      state.error = err.message;
+      pushLog(`[error] ${err.message}`);
+      console.error(`[tunnel] Error: ${err.message}`);
+      if (!resolved) {
+        resolved = true;
+        resolve({ error: err.message });
+      }
+    });
+
+    state.process.on('exit', (code) => {
+      const recentLog = state.log.slice(-5).join(' ').slice(0, 200);
+      const reason = code !== 0 ? `cloudflared failed (exit ${code}): ${recentLog || 'no output'}` : 'cloudflared stopped';
+      console.log(`[tunnel] ${reason}`);
+      state.process = null;
+      if (state.status !== 'error') {
+        state.status = 'stopped';
+      }
+      state.url = null;
+      saveTunnelState();
+      pushLog(`[exit] ${reason}`);
+      if (!resolved) {
+        resolved = true;
+        resolve({ error: reason });
+      }
+    });
+
+    setTimeout(() => {
+      if (!resolved) {
+        resolved = true;
+        if (!state.url) {
+          state.status = 'error';
+          state.error = 'Timeout waiting for tunnel URL';
+          resolve({ error: 'Timeout waiting for tunnel URL (30s)' });
+        }
+      }
+    }, 30000);
+  });
+}
+
+export function stopTunnel() {
+  console.log('[tunnel] Stopping tunnel');
+  stopHealthCheck();
+  if (state.process) {
+    state.process.kill('SIGTERM');
+    state.process = null;
+  }
+  // Also kill by saved PID in case another worker started it
+  const saved = loadTunnelState();
+  if (saved.pid) {
+    try { process.kill(saved.pid, 'SIGTERM'); } catch {}
+  }
+  state.url = null;
+  state.status = 'stopped';
+  state.error = null;
+  saveTunnelState();
+}
+
+export function getTunnelStatus() {
+  // If this worker has the process, use in-memory state
+  if (state.process) {
+    return {
+      status: state.status,
+      url: state.url,
+      error: state.error,
+      installed: isInstalled(),
+      log: state.log.slice(-20),
+    };
+  }
+  // Otherwise read from file (another worker may have started it)
+  const saved = loadTunnelState();
+  if (saved.pid && saved.status === 'running') {
+    try { process.kill(saved.pid, 0); } catch {
+      // Process dead — clear stale state
+      return { status: 'stopped' as const, url: null, error: null, installed: isInstalled(), log: [] };
+    }
+  }
+  return {
+    status: (saved.status || 'stopped') as TunnelState['status'],
+    url: saved.url,
+    error: saved.error,
+    installed: isInstalled(),
+    log: state.log.slice(-20),
+  };
+}
+
+// ─── Tunnel health check ──────────────────────────────────────
+
+let healthCheckTimer: ReturnType<typeof setInterval> | null = null;
+let consecutiveFailures = 0;
+const MAX_FAILURES = 3;
+const HEALTH_CHECK_INTERVAL = 60_000; // 60s
+
+async function checkTunnelHealth() {
+  if (state.status !== 'running' || !state.url) return;
+
+  try {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 10_000);
+    const res = await fetch(state.url, {
+      method: 'HEAD',
+      signal: controller.signal,
+      redirect: 'manual',
+    });
+    clearTimeout(timeout);
+
+    // Any response (including 302 to login) means tunnel is alive
+    if (res.status > 0) {
+      if (consecutiveFailures > 0) {
+        pushLog(`[health] Tunnel recovered after ${consecutiveFailures} failures`);
+      }
+      consecutiveFailures = 0;
+      return;
+    }
+  } catch {
+    // fetch failed — tunnel likely down
+  }
+
+  consecutiveFailures++;
+  pushLog(`[health] Tunnel unreachable (${consecutiveFailures}/${MAX_FAILURES})`);
+
+  if (consecutiveFailures >= MAX_FAILURES) {
+    pushLog('[health] Tunnel appears dead — restarting...');
+    state.status = 'error';
+    state.error = 'Tunnel unreachable — restarting';
+
+    // Kill old process and restart
+    if (state.process) {
+      state.process.kill('SIGTERM');
+      state.process = null;
+    }
+    state.url = null;
+    consecutiveFailures = 0;
+
+    // Restart after a short delay
+    setTimeout(async () => {
+      const result = await startTunnel();
+      if (result.url) {
+        pushLog(`[health] Tunnel restarted: ${result.url}`);
+        // Notify via Telegram if configured
+        try {
+          const { loadSettings } = await import('./settings');
+          const settings = loadSettings();
+          if (settings.telegramBotToken && settings.telegramChatId) {
+            await fetch(`https://api.telegram.org/bot${settings.telegramBotToken}/sendMessage`, {
+              method: 'POST',
+              headers: { 'Content-Type': 'application/json' },
+              body: JSON.stringify({
+                chat_id: settings.telegramChatId,
+                text: `🔄 Tunnel restarted\n\nNew URL: ${result.url}`,
+                disable_web_page_preview: true,
+              }),
+            });
+          }
+        } catch {}
+      } else {
+        pushLog(`[health] Tunnel restart failed: ${result.error}`);
+      }
+    }, 3000);
+  }
+}
+
+export function startHealthCheck() {
+  if (healthCheckTimer) return;
+  healthCheckTimer = setInterval(checkTunnelHealth, HEALTH_CHECK_INTERVAL);
+}
+
+export function stopHealthCheck() {
+  if (healthCheckTimer) {
+    clearInterval(healthCheckTimer);
+    healthCheckTimer = null;
+  }
+  consecutiveFailures = 0;
+}